MCP’s Rewrite Isn’t Vindication. It’s Convergence.

2026-07-19 · Source: LLM on Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Advanced, medium

Summary

The Model Context Protocol (MCP) is implementing its largest wire format revision since launch on July 28, 2026. This update makes MCP stateless at the protocol layer, removing the "initialize" handshake and "Mcp-Session-Id" header, and moving session state into explicit, model-visible arguments like "basket_id" or "browser_id". Authorization is significantly hardened through six SEPs, aligning with OAuth 2.0 and OpenID Connect deployments, requiring clients to validate the "iss" parameter per RFC 9207, and binding credentials to the issuing authorization server. The revision also promotes MCP Apps and Tasks to first-class extensions, routing UI actions through a consistent consent path. Notably, the release candidate was frozen on May 21, 2026, just after the NSA elevated MCP security concerns, indicating a convergence of understanding on critical fault lines rather than a direct response to subsequent criticism. However, the STDIO command-execution model remains untouched, leaving command injection vulnerabilities unaddressed.

Key takeaway

For AI Security Engineers and AI Architects deploying agentic systems, the MCP's July 28 revision significantly hardens authorization and clarifies state management. You should update your client implementations to validate the "iss" parameter. Ensure your agents explicitly handle session state. Be aware that the STDIO command-execution model remains a critical unaddressed vulnerability. This requires continued vigilance in your gateway configurations and agent permission scopes to mitigate command injection risks.

Key insights

The MCP's major revision reflects a convergence of security understanding, not a reactive fix, by addressing core protocol weaknesses.

Principles

• Protocol risk is a property of deployment, not single components.
• Hidden state increases trust surface and security vulnerabilities.
• Governance structures can address trust boundaries beyond technical specs.

Method

The MCP revision achieves statelessness by removing session headers and moving state into explicit, model-visible tool arguments, enabling round-robin load balancing and clearer state management.

In practice

• Validate "iss" parameter in authorization responses.
• Ensure state is visible to the model, not hidden.
• Route all UI actions through a consent path.

Topics

• Model Context Protocol
• Agentic AI Security
• Authorization Protocols
• Stateless Architecture
• Command Injection
• AI Governance

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Architect, AI Engineer

Related on AIssential

• Your developers are already running MCP servers you don’t know about — Ungoverned Model Context Protocol (MCP) servers create security and compliance risks, demanding proactive governance.
• Designing Safe Database Access for AI Agents using MCP — Secure AI agent database access requires an MCP server to provide domain-level tools, not direct SQL.
• No AI Agent Without Identity (Part 4): Deterministic Boundaries, Revocation, and MCP Enforcement — AI agent boundaries must be enforced deterministically by policy, not by the agent's probabilistic discretion, using short-lived credentials and control-plane revocation.
• Otto Support - SSRF and Token Passthrough with MCP — MCP servers' core functions make them inherently vulnerable to SSRF and token passthrough if inputs are untrusted.
• Your Insecure MCP Server Won't Survive Production — Tun Shwe, Lenses — Secure MCP server design requires agent-centric interfaces, robust authentication, and strict data governance to prevent vulnerabilities.
• Otto Support – An MCP, Agentic-AI Security Challenge — Model Context Protocol (MCP) systems significantly expand AI agent attack surfaces by enabling interaction with local resources and internal services.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by LLM on Medium.